Published: 15/10/2007 Updated: 29/09/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Multiple buffer overflows in eXtremail 2.1.1 and previous versions allow remote malicious users to (1) have an unknown impact by sending multiple long strings to the IMAP port (143/tcp); (2) execute arbitrary code via a long string in an IMAP AUTHENTICATE PLAIN action, involving the ifParseAuthPlain function; (3) execute arbitrary code via a long LOGIN command to the admin interface port (4501/tcp); or (4) execute arbitrary code via a long string in an IMAP AUTHENTICATE LOGIN (aka CRAM-MD5 authentication) action, involving the ifProcImapAuth1 function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
extremail extremail

/* extremail-v4c * * Copyright (c) 2006 by <mu-b@digit-labsorg> * * eXtremail <=211 remote root exploit (x86-lnx) * by mu-b - Sun Oct 08 2006 * * - Tested on: eXtremail 211 (lnx) * * Overflow in LOGIN command of admin interface * * - Private Source Code -DO NOT DISTRIBUTE - * wwwdigit-labsorg/ -- Digit-Labs 2 ...

#!/usr/bin/perl # # extremail-v8pl # # Copyright (c) 2007 by <mu-b@digit-labsorg> # # eXtremail <=211 remote PoC # by mu-b - Wed Jan 31 2007 # # Tested on: eXtremail 211 (lnx) # eXtremail 210 (lnx) # # - Private Source Code -DO NOT DISTRIBUTE - # wwwdigit-labsorg/ -- Digit-Labs 2007!@$! ######## use Getopt:: ...

/* extremail-v6c * * Copyright (c) 2006 by <mu-b@digit-labsorg> * * eXtremail <=211 remote root exploit (x86-lnx) * by mu-b - Wed Oct 18 2006 * * - Tested on: eXtremail 211 (lnx) * eXtremail 210 (lnx) * * Stack overflow in ifParseAuthPlain * * - Private Source Code -DO NOT DISTRIBUTE - * wwwdigi ...

CWE-119 http://www.securityfocus.com/archive/1/482293 http://www.digit-labs.org/files/exploits/extremail-v4.c http://www.digit-labs.org/files/exploits/extremail-v5.c http://www.digit-labs.org/files/exploits/extremail-v6.c http://www.digit-labs.org/files/exploits/extremail-v8.pl http://www.securityfocus.com/bid/26074 http://secunia.com/advisories/27220 https://exchange.xforce.ibmcloud.com/vulnerabilities/37209 https://www.exploit-db.com/exploits/4535 https://www.exploit-db.com/exploits/4534 https://www.exploit-db.com/exploits/4533 https://nvd.nist.gov https://www.exploit-db.com/exploits/4533/

CVE-2007-5466

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect